@celilo/e2e 0.20.3 → 0.20.5

package/docker/Dockerfile.apt-repo-sim

@@ -17,7 +17,7 @@
 # generated HERE, at docker-build time, because dpkg-scanpackages /
 # apt-ftparchive aren't available on the macOS build host.
 
-FROM debian:trixie-slim
+FROM debian:trixie-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a
 
 RUN apt-get update \
  && apt-get install -y --no-install-recommends dpkg-dev apt-utils python3 \

package/docker/Dockerfile.authoritative-dns

@@ -1,4 +1,4 @@
-FROM cznic/knot
+FROM cznic/knot@sha256:166fd8956f1a69eeb6558c28f65cedb4ea112d4689317f4a50c2f2787ee6a622
 
 RUN apt-get update && apt-get install -y \
     iproute2 \

package/docker/Dockerfile.celilo-website-sim

@@ -1,4 +1,4 @@
-FROM debian:bookworm-slim
+FROM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251
 
 # Caddy + tools needed by entrypoint.sh. iproute2 provides `ip` so the
 # entrypoint can rewrite the default route through fw-ext (same pattern

package/docker/Dockerfile.cpanel-host-sim

@@ -13,7 +13,7 @@
 #
 # No systemd: sshd + apache are all this host runs, so a two-process entrypoint
 # is enough and boots in a fraction of the time.
-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02
 
 ENV DEBIAN_FRONTEND=noninteractive
 

package/docker/Dockerfile.dhcp-client

@@ -1,4 +1,4 @@
-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02
 
 ENV DEBIAN_FRONTEND=noninteractive
 

package/docker/Dockerfile.firewall

@@ -1,4 +1,4 @@
-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02
 
 # Make apt resilient to flaky upstream (no apt-cacher-ng masking transient errors)
 COPY config/apt/99retries.conf /etc/apt/apt.conf.d/99retries.conf

package/docker/Dockerfile.forward-proxy

@@ -1,4 +1,4 @@
-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02
 
 RUN apt-get update && apt-get install -y \
     squid-openssl \

package/docker/Dockerfile.greenwave-sim

@@ -1,4 +1,4 @@
-FROM oven/bun:latest
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 RUN apt-get update && apt-get install -y \
     openssh-server \

package/docker/Dockerfile.internal-resolver

@@ -1,4 +1,4 @@
-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02
 
 RUN apt-get update && apt-get install -y \
     unbound \

package/docker/Dockerfile.ip-echo

@@ -1,4 +1,4 @@
-FROM oven/bun:latest
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 # iproute2 so the entrypoint can see its own addressing when debugging; the
 # service itself needs no routing changes (it sits on internet-external with

package/docker/Dockerfile.isitup

@@ -1,4 +1,4 @@
-FROM oven/bun:latest
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 # Caddy (for ACME/TLS termination) + tools needed by entrypoint.sh.
 # iproute2 provides `ip` so the entrypoint can rewrite the default route

package/docker/Dockerfile.management

@@ -1,4 +1,4 @@
-FROM oven/bun:latest
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 # This Dockerfile produces a *vanilla* management image — bun + unzip +
 # bunfig, no celilo. `cele2e build-infra` runs install.sh inside a

package/docker/Dockerfile.minio

@@ -17,14 +17,14 @@
 # well-known minioadmin/minioadmin; the migration test passes them to
 # `celilo storage add s3 --access-key-id ... --secret-access-key ...`.
 
-FROM minio/mc:latest AS mc
+FROM quay.io/minio/mc:latest@sha256:a7fe349ef4bd8521fb8497f55c6042871b2ae640607cf99d9bede5e9bdf11727 AS mc
 
 # Static busybox purely for its `ip` applet: the MinIO image has no iproute2
 # and no package manager worth invoking, but it still needs the ISP route
 # every host on internet-external carries (see minio-startup.sh).
-FROM busybox:stable-musl AS busybox
+FROM busybox:stable-musl@sha256:3c6ae8008e2c2eedd141725c30b20d9c36b026eb796688f88205845ef17aa213 AS busybox
 
-FROM minio/minio:latest
+FROM quay.io/minio/minio:latest@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
 
 COPY --from=busybox /bin/busybox /usr/local/bin/busybox
 

package/docker/Dockerfile.namecheap-dns

@@ -1,4 +1,4 @@
-FROM cznic/knot
+FROM cznic/knot@sha256:166fd8956f1a69eeb6558c28f65cedb4ea112d4689317f4a50c2f2787ee6a622
 
 RUN apt-get update && apt-get install -y \
     iproute2 \

package/docker/Dockerfile.npm-registry-sim

@@ -1,4 +1,4 @@
-FROM oven/bun:1
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 WORKDIR /app
 

package/docker/Dockerfile.observer

@@ -6,7 +6,7 @@
 # Its faithfulness as a vantage comes from the routing profile installed at startup
 # (see config/routing/observer-setup.sh), driven by the OBSERVER_* env the compose
 # generator sets per vantage.
-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02
 
 ENV DEBIAN_FRONTEND=noninteractive
 

package/docker/Dockerfile.pebble

@@ -1,6 +1,6 @@
-FROM ghcr.io/letsencrypt/pebble:latest AS pebble
+FROM ghcr.io/letsencrypt/pebble:latest@sha256:ddf230642b1a584f519f32e347de1b05a6e4c1f6c35c1863b33effeab5f78199 AS pebble
 
-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02
 
 RUN apt-get update && apt-get install -y \
     iproute2 \

package/docker/Dockerfile.proxmox-sim

@@ -1,4 +1,4 @@
-FROM oven/bun:1
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 WORKDIR /app
 

package/docker/Dockerfile.registry

@@ -1,4 +1,4 @@
-FROM oven/bun:1
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 WORKDIR /app
 

package/docker/Dockerfile.resolver

@@ -1,4 +1,4 @@
-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02
 
 RUN apt-get update && apt-get install -y \
     unbound \

package/docker/Dockerfile.router

@@ -1,4 +1,4 @@
-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02
 
 RUN apt-get update && apt-get install -y \
     iproute2 \

package/docker/Dockerfile.signal-cli

@@ -24,7 +24,7 @@
 
 ARG SIGNAL_CLI_VERSION=0.14.6
 
-FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS fetch
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251 AS fetch
 ARG SIGNAL_CLI_VERSION
 RUN apt-get update \
     && apt-get install -y --no-install-recommends curl ca-certificates \
@@ -44,7 +44,7 @@ RUN curl -fsSL \
     && mkdir -p /out/schemas \
     && tar -xzf /tmp/schemas.tar.gz -C /out/schemas
 
-FROM --platform=linux/amd64 eclipse-temurin:25-jre
+FROM --platform=linux/amd64 eclipse-temurin:25-jre@sha256:bb036ed6cfdc57e3da7c22634d15f1b840d2caf76183861c80e81ca4b5104abb
 COPY --from=fetch /out/signal-cli /opt/signal-cli
 COPY --from=fetch /out/schemas /opt/signal-cli-schemas
 

package/docker/Dockerfile.signal-release

@@ -13,7 +13,7 @@
 
 ARG SIGNAL_CLI_VERSION=0.14.6
 
-FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS fetch
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251 AS fetch
 ARG SIGNAL_CLI_VERSION
 RUN apt-get update \
     && apt-get install -y --no-install-recommends curl ca-certificates \
@@ -31,7 +31,7 @@ RUN mkdir -p "/out/v${SIGNAL_CLI_VERSION}" \
       "https://github.com/AsamK/signal-cli/releases/download/v${SIGNAL_CLI_VERSION}/signal-cli-${SIGNAL_CLI_VERSION}.tar.gz" \
       -o "/out/v${SIGNAL_CLI_VERSION}/signal-cli-${SIGNAL_CLI_VERSION}.tar.gz"
 
-FROM nginx:alpine
+FROM nginx:alpine@sha256:62ff2089abf5a9ed33bd232895bef5e22f7bb4b200675cec49a5ebc48e3d4ac8
 COPY --from=fetch /out /usr/share/nginx/html
 
 # Route the customer's public prefix via the ISP edge, like every other host on

package/docker/Dockerfile.signal-sim

@@ -6,7 +6,7 @@
 # arrives: it can queue an inbound reply, fail a recipient inside a success,
 # and revoke the device link on demand — none of which the real unlinked
 # daemon can be made to do.
-FROM oven/bun:1
+FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 WORKDIR /app
 COPY simulators/signal-cli/server.ts ./server.ts

package/docker/Dockerfile.socks-proxy

@@ -11,7 +11,7 @@
 #     internet (split-horizon, namecheap publication, etc.)
 # The startup script handles both based on the VANTAGE env var passed
 # at `docker run` time.
-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02
 
 RUN apt-get update && apt-get install -y \
     dante-server \

package/docker/Dockerfile.target-machine

@@ -1,4 +1,4 @@
-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02
 
 ENV DEBIAN_FRONTEND=noninteractive
 

package/docker/Dockerfile.target-machine-docker

@@ -2,7 +2,7 @@
 # Used for app-zone machines that run Docker Compose workloads (e.g. authentik).
 # Docker itself is baked in; application images are pulled at deploy time by each module.
 
-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02
 
 ENV DEBIAN_FRONTEND=noninteractive
 

package/docker/Dockerfile.target-technitium

@@ -2,7 +2,7 @@
 # Based on target-machine; Technitium is installed at image build time so the
 # Ansible role finds it already present and skips the download step.
 
-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02
 
 ENV DEBIAN_FRONTEND=noninteractive
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.20.3",
+  "version": "0.20.5",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -38,9 +38,9 @@
     "README.md"
   ],
   "dependencies": {
-    "@celilo/capabilities": "^5.0.0",
+    "@celilo/capabilities": "^5.1.1",
     "@celilo/cli-display": "^0.2.0",
-    "@celilo/event-bus": "^0.6.0",
+    "@celilo/event-bus": "^0.7.0",
     "@celilo/terraform-fake": "^0.3.1",
     "yaml": "^2.8.0",
     "zod": "^3.24.1"

package/scripts/dockerhub-login.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Authenticate the builder to Docker Hub before any e2e image build.
+#
+# celilo#1376: the e2e base images are digest-pinned, which makes a pull
+# REPRODUCIBLE — it does not make it ALLOWED. Docker Hub meters anonymous pulls
+# per source IP, and once the builder's share is spent every pull fails at
+# `load metadata` with:
+#
+#   ERROR: pull access denied ... insufficient_scope: authorization failed
+#
+# which reads like a missing image rather than a spent quota. An authenticated
+# pull draws on the account's much larger allowance instead.
+#
+# No credentials configured (a fork, a local run) => stay anonymous and say so,
+# rather than failing the build for a quota that may well not be spent.
+set -eu
+
+if [ -z "${DOCKERHUB_USERNAME:-}" ] || [ -z "${DOCKERHUB_TOKEN:-}" ]; then
+  echo "DOCKERHUB_USERNAME/DOCKERHUB_TOKEN unset — pulling Docker Hub anonymously."
+  echo "Anonymous pulls share this host's IP quota; a spent quota fails as"
+  echo "'insufficient_scope: authorization failed' at 'load metadata' (celilo#1376)."
+  exit 0
+fi
+
+printf '%s' "${DOCKERHUB_TOKEN}" |
+  docker login --username "${DOCKERHUB_USERNAME}" --password-stdin

package/src/doctor.test.ts

@@ -47,6 +47,7 @@ function healthyProbe(overrides: Partial<DoctorProbe> = {}): DoctorProbe {
     imageExists: () => true,
     imageCmd: () => [EXPECTED_MANAGEMENT_CMD],
     imageLabel: () => null,
+    celiloVersion: () => '1.2.3',
     staleContainers: () => [],
     reclaimableImageBytes: () => 0,
     leakedStacks: () => [],
@@ -103,6 +104,22 @@ describe('management image (problem 1: the bake fails as an SSH error)', () => {
     expect(check.remedy).toBe('cele2e build-infra');
   });
 
+  test('a hollow image — starts fine, no celilo inside — FAILS', () => {
+    // celilo#1390: doctor said "2 baked images present, both running
+    // /startup.sh" about an image with no celilo binary at all.
+    const check = checkManagementImage(healthyProbe({ celiloVersion: () => null }));
+    expect(check.status).toBe('fail');
+    expect(check.detail).toContain('HOLLOW');
+    expect(check.detail).toContain('127');
+    expect(check.remedy).toBe('cele2e build-infra');
+  });
+
+  test('a passing check reports the version it found, so a stale bake is visible too', () => {
+    const check = checkManagementImage(healthyProbe({ celiloVersion: () => '0.42.1' }));
+    expect(check.status).toBe('ok');
+    expect(check.detail).toContain('0.42.1');
+  });
+
   test('both images present and correctly baked passes', () => {
     const check = checkManagementImage(healthyProbe());
     expect(check.status).toBe('ok');

package/src/doctor.ts

@@ -105,6 +105,12 @@ export interface DoctorProbe {
   imageCmd(ref: string): string[] | null;
   /** One label off the image, or null when the image or the label is absent. */
   imageLabel(ref: string, label: string): string | null;
+  /**
+   * `celilo --version` run INSIDE the image, or null when the binary is absent
+   * or does not run. This is the only check that opens the image up; every
+   * other one reasons about metadata, which is how a hollow image passed.
+   */
+  celiloVersion(ref: string): string | null;
   /** Names of leftover `celilo-e2e-*` containers. */
   staleContainers(): string[];
   /** Bytes docker reports as reclaimable image space. */
@@ -228,10 +234,24 @@ export function checkManagementImage(probe: DoctorProbe): DoctorCheck {
       remedy: 'cele2e build-infra',
     };
   }
+  // The contract every stage depends on: a celilo binary that actually runs.
+  // A failed bake (celilo#1365, the install.sh fetch timing out) leaves the
+  // image present, correctly Cmd'd and completely hollow, and the suite then
+  // dies at stage 1 with `celilo --version exited 127` — which reads as a test
+  // defect rather than the bake failure it is.
+  const version = probe.celiloVersion(MANAGEMENT_LATEST);
+  if (!version) {
+    return {
+      name: 'management-image',
+      status: 'fail',
+      detail: `${MANAGEMENT_LATEST} is HOLLOW — it starts, but \`celilo\` is not on PATH inside it, so every stage dies with "celilo --version exited 127: command not found". The bake failed and left the image behind`,
+      remedy: 'cele2e build-infra',
+    };
+  }
   return {
     name: 'management-image',
     status: 'ok',
-    detail: `${BAKED_MANAGEMENT_IMAGES.length} baked images present, both running ${EXPECTED_MANAGEMENT_CMD}`,
+    detail: `${BAKED_MANAGEMENT_IMAGES.length} baked images present, both running ${EXPECTED_MANAGEMENT_CMD}; celilo ${version} inside ${MANAGEMENT_LATEST}`,
   };
 }
 
@@ -565,6 +585,22 @@ export function createDockerProbe(): DoctorProbe {
         return null;
       }
     },
+    celiloVersion(ref) {
+      try {
+        const out = docker([
+          'run',
+          '--rm',
+          '--entrypoint',
+          'sh',
+          ref,
+          '-c',
+          'command -v celilo >/dev/null 2>&1 && celilo --version',
+        ]);
+        return out === '' ? null : out.split('\n').pop()?.trim() || null;
+      } catch {
+        return null;
+      }
+    },
     staleContainers() {
       try {
         return docker(['ps', '-a', '--filter', 'name=celilo-e2e', '--format', '{{.Names}}'])

package/src/host-vm.test.ts

@@ -113,6 +113,42 @@ describe('evaluateHostVm', () => {
     expect(evaluateHostVm(vm({ cpus: 16 }), M1_PRO, budget).problems[0]).toContain('16 CPUs');
   });
 
+  test('half the policy CPUs is flagged — the measured case that read as a match', () => {
+    const verdict = evaluateHostVm(vm({ cpus: 4 }), M1_PRO, budget);
+    expect(verdict.problems).toHaveLength(1);
+    expect(verdict.problems[0]).toContain('4 CPUs');
+    // colima resizes CPUs on a restart, so this must not demand the destructive path.
+    expect(verdict.needsRecreate).toBe(false);
+  });
+
+  test('memory below the policy is flagged', () => {
+    const verdict = evaluateHostVm(vm({ memoryGiB: 4 }), M1_PRO, budget);
+    expect(verdict.problems).toHaveLength(1);
+    expect(verdict.problems[0]).toContain('4 GiB');
+    expect(verdict.needsRecreate).toBe(false);
+  });
+
+  /**
+   * The property that actually failed in celilo#1395: `budget.cpus` was
+   * computed, printed inside another rule's message, and never compared. A
+   * per-rule test cannot express that — it can only break rules that exist.
+   * So drive every budget field away from the budget and require a sentence
+   * back. A field used only in a template string produces none.
+   */
+  test('every field of the budget is compared, not merely printed', () => {
+    const diverge: Record<keyof typeof budget, Partial<HostVmFacts>> = {
+      cpus: { cpus: budget.cpus - 1 },
+      memoryGiB: { memoryGiB: budget.memoryGiB - 1 },
+      mountType: { mountType: 'sshfs' },
+    };
+    for (const [field, override] of Object.entries(diverge)) {
+      expect(
+        evaluateHostVm(vm(override), M1_PRO, budget).problems,
+        `budget.${field} diverged but no rule fired`,
+      ).not.toEqual([]);
+    }
+  });
+
   test('several problems are all reported, not just the first', () => {
     const verdict = evaluateHostVm(vm({ memoryGiB: 24, mountType: 'sshfs', cpus: 16 }), M1_PRO, {
       ...budget,

package/src/host-vm.ts

@@ -221,10 +221,20 @@ export function evaluateHostVm(
     // colima discards a mount-type change on an existing VM.
     needsRecreate = true;
   }
+  if (facts.memoryGiB < budget.memoryGiB) {
+    problems.push(
+      `VM memory is ${facts.memoryGiB} GiB, below the ${budget.memoryGiB} GiB this host can afford it — the guest has less page cache than the rig's images need, so reads that should be cached hit the disk.`,
+    );
+  }
   if (facts.cpus > host.cpus) {
     problems.push(
       `VM is configured with ${facts.cpus} CPUs but the host has ${host.cpus}. Recommended: ${budget.cpus}.`,
     );
+  } else if (facts.cpus < budget.cpus) {
+    // colima resizes CPUs on a restart, so this does NOT need a recreate.
+    problems.push(
+      `VM has ${facts.cpus} CPUs against a policy of ${budget.cpus} on a ${host.cpus}-core host — a suite runs on the cores the VM was given, not the ones the host has. Recommended: ${budget.cpus}.`,
+    );
   }
   return { problems, needsRecreate };
 }